DKIM Record Checker
Look up DKIM (DomainKeys Identified Mail) records for any domain and selector. Enter a domain name, choose a DKIM selector, and instantly see the parsed DKIM tags, public key details, and cryptographic strength. Supports 10 preset selectors including Google Workspace, Microsoft 365, Zoho, and ProtonMail. Fully private, 100% free, and no signup required.
Enter a domain name and DKIM selector to look up its DKIM public key record. The tool queries DNS via DNS-over-HTTPS and parses the DKIM tags for you.
DKIM records are stored at <selector>._domainkey.<domain> as TXT records.
Why Use Our DKIM Record Checker?
Instant DKIM Record Lookup
Query DKIM TXT records from DNS in real time. Enter any domain and selector, and our DKIM record checker fetches the public key record via DNS-over-HTTPS. Results appear instantly with all parsed tags clearly displayed.
DKIM Tag Parsing & Validation
Automatically parse and validate every DKIM tag (v=, p=, s=, h=, k=, t=, etc.). Each tag is checked against RFC 6376 standards with warnings for misconfigurations. No manual decoding needed.
Public Key Analysis
Analyze the DKIM public key to determine the key type (RSA or Ed25519), key length (512-bit to 4096-bit), and cryptographic strength. Know immediately if your DKIM key meets current security recommendations.
Selector Presets & Quick Domain Checks
Quick-select from 10 common DKIM selectors (Google, Microsoft 365, Zoho, ProtonMail, and more) and 5 preset domains. No need to remember selector names - just click and check.
Common Use Cases for DKIM Record Checker
Email Deliverability Troubleshooting
When emails from your domain are being rejected or marked as spam, verify that your DKIM record is correctly configured and accessible via DNS. Our DKIM record checker confirms the public key is published correctly for receiving servers to verify your email signatures.
Email Security Audit
Audit your domain's email authentication posture by checking that DKIM records are properly configured with strong cryptographic keys. Verify key length (2048-bit RSA minimum recommended) and ensure all required DKIM tags are present and valid.
New Email Provider Migration
When migrating to a new email provider (Google Workspace, Microsoft 365, Zoho, etc.), confirm that the correct DKIM selector and public key have been added to your DNS. Our tool validates the record format before you switch over email routing.
DKIM Configuration Verification
After setting up DKIM for your domain, verify that the TXT record is correctly formatted with all required tags. The tool parses each tag and highlights any issues with version, key type, flags, or public key format.
Pre-Deployment DNS Check
Before making DNS changes live, verify that DKIM records are properly configured and resolvable. Our DKIM record checker confirms DNS propagation and record validity so you can deploy with confidence.
DMARC Compliance Preparation
DKIM is a prerequisite for DMARC enforcement. Use the DKIM record checker to ensure your DKIM setup is correct before implementing a DMARC reject policy. Verify alignment between the d= tag and your domain.
Understanding DKIM Records
What is a DKIM Record?
DKIM (DomainKeys Identified Mail) is an email authentication method that allows a domain to cryptographically sign its outgoing emails. A DKIM record is a DNS TXT record stored at<selector>._domainkey.<domain> that contains the public key used by receiving mail servers to verify the signature on incoming emails.
When configured correctly, DKIM helps prevent email spoofing and phishing by ensuring that emails claiming to be from your domain were genuinely sent by your authorised mail servers.
How Our DKIM Record Checker Works
Our DKIM record checker queries DNS via DNS-over-HTTPS and parses the DKIM TXT record into readable component tags.
- Enter domain and selector - Provide the domain name and DKIM selector configured in your email provider. Common selectors include "default", "google", "selector1", and "selector2".
- DNS lookup - The tool performs a TXT record query to
<selector>._domainkey.<domain>via Cloudflare DNS-over-HTTPS. - Parse and analyze - The raw DKIM record is parsed into individual tags. The public key (p= tag) is analysed to determine key type, length, and cryptographic strength.
What Gets Parsed in a DKIM Record
A DKIM DNS record contains several standardized tags defined by RFC 6376. Our checker parses each one:
- v= (Version) - Must be "DKIM1". Indicates the record follows the DKIM specification.
- p= (Public Key) - The base64-encoded public key used for signature verification. The most critical tag for authentication.
- k= (Key Type) - Indicates the cryptographic algorithm: "rsa" for RSA keys or "ed25519" for Ed25519 keys.
- s= (Selector) - The DKIM selector identifier used to look up this specific key from DNS.
- t= (Flags) - Optional flags: "y" indicates testing mode, "s" restricts the key to the exact domain (not subdomains).
- h= (Signed Headers) - Lists which email headers are covered by the DKIM signature for protection.
Privacy & Security
All DKIM record lookups are performed directly from your browser to Cloudflare DNS-over-HTTPS with no intermediary server, storage, or logging. The tool runs entirely client-side - no domain names or DKIM records are sent to any backend server. This ensures complete privacy while checking your DKIM configuration.
DKIM records are public by design (they are published in DNS), so the tool simply fetches what is already publicly accessible through DNS. No authentication or sensitive data is involved in the lookup process.
Related Tools
SPF Record Checker
Validate SPF records for a domain via TXT record lookup. Checks syntax, lookups limit (max 10), and common misconfigurations.
DMARC Record Checker
Check DMARC records and validate policy (none, quarantine, reject). Shows aggregate/forensic reporting addresses and alignment settings.
MX Record Lookup
Look up mail exchange (MX) records for any domain. Shows priority and mail server hostnames.
DNS Propagation Checker
Check if DNS changes have propagated by querying multiple global nameservers. Shows propagation status across DNS servers.
Frequently Asked Questions About DKIM Record Checker
A DKIM record checker is a tool that looks up and parses DKIM (DomainKeys Identified Mail) TXT records from DNS. It queries the DKIM record at the standard DNS location - {selector}._domainkey.{domain} - and displays the parsed DKIM tags (v=, p=, k=, s=, t=, etc.) in a human-readable format. It also analyzes the public key to determine key type, length, and cryptographic strength.
A DKIM selector is a unique identifier that points to a specific DKIM public key record in your DNS. Your email provider assigns the selector when you set up DKIM. Common selectors include "default", "google" (for Google Workspace), "selector1" or "selector2" (for Microsoft 365), "zoho" (for Zoho Mail), and "protonmail" (for ProtonMail). Check your email provider's DKIM setup documentation to find your exact selector value.
Yes. All DNS queries are made directly from your browser to Cloudflare DNS-over-HTTPS using an encrypted HTTPS connection. Your domain lookups are never sent to any intermediary server, stored in any database, or logged by our tool. DKIM records are public DNS records by design, so the tool simply fetches what is already publicly accessible.
A valid DKIM record is a DNS TXT record containing tags in the format "key=value" separated by semicolons. A typical DKIM record looks like: "v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...; k=rsa; t=y". The v= tag must be set to "DKIM1" per RFC 6376. The p= tag contains the base64-encoded public key and is the only required tag.
Current security best practices recommend using a 2048-bit RSA key for DKIM. While 1024-bit keys are still commonly used and functional, they are considered weaker and may be phased out by major email providers. Google Workspace and Microsoft 365 both support and recommend 2048-bit DKIM keys. Ed25519 keys (256-bit) are a modern alternative offering strong security with smaller record sizes.
Yes, our DKIM record checker is 100% free to use with no signup required, no usage limits, and no hidden charges. Check as many domains and selectors as you need - there are no restrictions on the number of lookups you can perform. No registration, no API keys, and no premium features.
DKIM and SPF are both email authentication methods but work differently. DKIM uses a cryptographic signature and public key to verify that an email was not tampered with during transit and genuinely came from the claimed domain. SPF (Sender Policy Framework) uses a list of authorised sending IP addresses published in DNS. Both are recommended alongside DMARC for comprehensive email authentication.
Yes, DKIM and DMARC work together. DMARC (Domain-based Message Authentication, Reporting & Conformance) uses DKIM (along with SPF) to determine whether an email passes authentication. When DKIM passes, DMARC checks that the d= tag domain aligns with the domain in the From header. This alignment is required for DMARC enforcement. Our DKIM record checker helps verify that your DKIM setup is correct before implementing a DMARC reject policy.